Communication Playbook

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 9:28 AM UTC
• Version: 0.1.0

Overview

This is a communication-coaching skill with no executable payload or hidden data access, though its README uses mutable install and scan commands that users should treat carefully.

Before installing, prefer a pinned installer version and a reviewed commit or release instead of mutable latest-style commands, and consider project-local installation rather than global installation. Treat the skill as communication guidance only, and keep human/legal review for regulatory, investor, personnel, or other sensitive outbound communications.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:14

Finding

Unpinned Dependencies and Mutable Remote Installation Source

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 14 and 20
Vulnerability Type: Supply-chain exposure through unpinned executable dependencies and a mutable remote source
Risk Level: Medium

Complete Code Snippet

bash

npx skills add https://github.com/Hey-Salad/communication-playbook-skill --skill communication-playbook --yes --global

bash

uvx snyk-agent-scan@latest --skills SKILL.md

Technical Analysis

The documented commands retrieve and execute tooling without immutable version constraints:

• npx skills does not specify an exact package version.
• snyk-agent-scan@latest explicitly resolves to a mutable release.
• The GitHub installation URL is not pinned to a reviewed commit hash or immutable release artifact.
• The installation uses --global, increasing the persistence and scope of any compromised content.

Package-manager execution commands can run package lifecycle logic or downloaded application code with the invoking user's privileges. Because the resolved content can change after this repository has been reviewed, auditing the two Markdown files does not establish the integrity of code subsequently fetched by these commands.

This is a supply-chain weakness rather than evidence that the current project contains malicious code. Exploitation requires compromise or malicious modification of an upstream package, account, repository, release, or dependency-resolution path.

Attack Path

1. An attacker compromises an upstream package, maintainer account, release process, or referenced GitHub repository.
2. The attacker publishes a malicious version under the package name resolved by npx skills, replaces the release selected by @latest, or alters the unpinned repository content.
3. A user follows the installation or scanning instructions in README.md.
4. npx or uvx retrieves the mutable attacker-controlled content.
5. The downloaded tooling executes with the user's local privileges.
6. In the ...[truncated 777 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every executable package to an exact, reviewed version instead of relying on implicit resolution or @latest.
2. Pin the Skill source to a reviewed immutable commit hash or signed release artifact rather than a mutable repository URL.
3. Verify package signatures, provenance attestations, lockfiles, or published checksums before execution.
4. Remove --global unless global installation is strictly required. Prefer a project-local, isolated installation.
5. Run installation and scanning commands in a sandbox, container, or least-privileged environment without unnecessary credentials.
6. Configure package managers to disable lifecycle scripts where compatible with the tooling.
7. Establish an update process that reviews new versions before changing pins.
8. Document the trusted publisher, expected package identity, exact version, and integrity verification procedure in README.md.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill’s trigger criteria are extremely broad and instruct the agent to use this skill for virtually any communication-related task, including generic drafting, review, meetings, documentation, and tone advice. In an agentic system, this creates overreach risk: the skill can intercept many unrelated requests, shape outputs beyond user intent, and crowd out more narrowly scoped or safer skills, increasing the chance of unintended disclosure, bad advice in regulated contexts, or prompt-surface abuse.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README instructs users to run npx skills add ... without pinning the skills package to a specific version. That allows whatever version is current at install time to execute, which creates a supply-chain risk if a later malicious or compromised release is published. In a skill-installation context, this is more dangerous because users are explicitly encouraged to fetch and execute code from package registries during setup.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The command uvx snyk-agent-scan@latest --skills SKILL.md explicitly uses @latest, which guarantees execution of an unpinned future version rather than a reviewed release. If the package is ever compromised or a breaking/malicious update is published, users following the README could execute attacker-controlled code. Because this is presented as a security scanning step, users may trust it more and run it with less scrutiny, slightly increasing practical risk.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 285)May include surrounding context.

md

### Levels of Transparency
| Level | What It Means | Use For |
|-------|--------------|---------|
| Default Open | All information available without asking | Docs, wikis, roadmaps |
| Share on Request | Available to anyone who asks | Sensitive but non-confidential data |
| Need to Know | Restricted to those directly involved | Personnel matters, legal strategy |
| Confidential | Formal agreement required | Board matters, regulatory submissions |

Static analysis

No suspicious patterns detected.